diff --git a/src/cli/repo/s3.go b/src/cli/repo/s3.go
index 73fff09b6..bb8c68ca9 100644
--- a/src/cli/repo/s3.go
+++ b/src/cli/repo/s3.go
@@ -15,6 +15,7 @@ var (
 	accessKey string
 	bucket    string
 	endpoint  string
+	prefix    string
 )
 
 // called by repo.go to map parent subcommands to provider-specific handling.
@@ -32,6 +33,7 @@ func addS3Commands(parent *cobra.Command) *cobra.Command {
 	fs.StringVar(&bucket, "bucket", "", "Name of the S3 bucket (required).")
 	c.MarkFlagRequired("bucket")
 	fs.StringVar(&endpoint, "endpoint", "s3.amazonaws.com", "Server endpoint for S3 communication.")
+	fs.StringVar(&prefix, "prefix", "", "Prefix applied to objects in the bucket.")
 	return c
 }
 
@@ -119,6 +121,7 @@ func makeS3Config() storage.S3Config {
 		AccessKey:    ak,
 		Bucket:       bucket,
 		Endpoint:     endpoint,
+		Prefix:       prefix,
 		SecretKey:    os.Getenv("AWS_SECRET_ACCESS_KEY"),
 		SessionToken: os.Getenv("AWS_SESSION_TOKEN"),
 	}
diff --git a/src/internal/kopia/s3.go b/src/internal/kopia/s3.go
index 1b2318876..2990cb27c 100644
--- a/src/internal/kopia/s3.go
+++ b/src/internal/kopia/s3.go
@@ -22,6 +22,7 @@ func s3BlobStorage(ctx context.Context, cfg storage.S3Config) (blob.Storage, err
 		AccessKeyID:     cfg.AccessKey,
 		BucketName:      cfg.Bucket,
 		Endpoint:        endpoint,
+		Prefix:          cfg.Prefix,
 		SecretAccessKey: cfg.SecretKey,
 		SessionToken:    cfg.SessionToken,
 	}
diff --git a/src/pkg/storage/s3.go b/src/pkg/storage/s3.go
index 731d8b110..d47219f6c 100644
--- a/src/pkg/storage/s3.go
+++ b/src/pkg/storage/s3.go
@@ -4,6 +4,7 @@ type S3Config struct {
 	AccessKey    string
 	Bucket       string
 	Endpoint     string
+	Prefix       string
 	SecretKey    string
 	SessionToken string
 }
@@ -12,6 +13,7 @@ const (
 	keyS3AccessKey    = "s3_accessKey"
 	keyS3Bucket       = "s3_bucket"
 	keyS3Endpoint     = "s3_endpoint"
+	keyS3Prefix       = "s3_prefix"
 	keyS3SecretKey    = "s3_secretKey"
 	keyS3SessionToken = "s3_sessionToken"
 )
@@ -21,6 +23,7 @@ func (c S3Config) Config() config {
 		keyS3AccessKey:    c.AccessKey,
 		keyS3Bucket:       c.Bucket,
 		keyS3Endpoint:     c.Endpoint,
+		keyS3Prefix:       c.Prefix,
 		keyS3SecretKey:    c.SecretKey,
 		keyS3SessionToken: c.SessionToken,
 	}
@@ -33,6 +36,7 @@ func (s Storage) S3Config() S3Config {
 		c.AccessKey = s.Config[keyS3AccessKey].(string)
 		c.Bucket = s.Config[keyS3Bucket].(string)
 		c.Endpoint = s.Config[keyS3Endpoint].(string)
+		c.Prefix = s.Config[keyS3Prefix].(string)
 		c.SecretKey = s.Config[keyS3SecretKey].(string)
 		c.SessionToken = s.Config[keyS3SessionToken].(string)
 	}
diff --git a/src/pkg/storage/s3_test.go b/src/pkg/storage/s3_test.go
index 76e731e77..275761d61 100644
--- a/src/pkg/storage/s3_test.go
+++ b/src/pkg/storage/s3_test.go
@@ -7,7 +7,7 @@ import (
 )
 
 func TestS3Config_Config(t *testing.T) {
-	s3 := storage.S3Config{"ak", "bkt", "end", "sk", "tkn"}
+	s3 := storage.S3Config{"ak", "bkt", "end", "pre", "sk", "tkn"}
 	c := s3.Config()
 	table := []struct {
 		key    string
@@ -16,6 +16,7 @@ func TestS3Config_Config(t *testing.T) {
 		{"s3_bucket", s3.Bucket},
 		{"s3_accessKey", s3.AccessKey},
 		{"s3_endpoint", s3.Endpoint},
+		{"s3_prefix", s3.Prefix},
 		{"s3_secretKey", s3.SecretKey},
 		{"s3_sessionToken", s3.SessionToken},
 	}
@@ -29,7 +30,7 @@ func TestS3Config_Config(t *testing.T) {
 }
 
 func TestStorage_S3Config(t *testing.T) {
-	in := storage.S3Config{"ak", "bkt", "end", "sk", "tkn"}
+	in := storage.S3Config{"ak", "bkt", "end", "pre", "sk", "tkn"}
 	s := storage.NewStorage(storage.ProviderS3, in)
 	out := s.S3Config()
 	if in.Bucket != out.Bucket {
@@ -41,6 +42,9 @@ func TestStorage_S3Config(t *testing.T) {
 	if in.Endpoint != out.Endpoint {
 		t.Errorf("expected S3Config.Endpoint to be [%s], got [%s]", in.Endpoint, out.Endpoint)
 	}
+	if in.Prefix != out.Prefix {
+		t.Errorf("expected S3Config.Prefix to be [%s], got [%s]", in.Prefix, out.Prefix)
+	}
 	if in.SecretKey != out.SecretKey {
 		t.Errorf("expected S3Config.SecretKey to be [%s], got [%s]", in.SecretKey, out.SecretKey)
 	}